Does it have to be installed though? Can’t you just load the driver, if it’s signed and not on the driver block list now on 22H2?

You have to be a local administrator to load a driver.

Even a "local admin to Ring0 without reboot"-exploit might have some uses in malware.

But that already exists. There are thousands of signed drivers; many around are bound to be exploitable. But it's not Windows' fault that you installed one.

The truth of the matter is that if you are local admin you can already ruin the system in many ways. Once you are admin the game is already over.

Imagine you're my clueless family relative and you end up installing one of those signed-yet-exploitable drivers.

Whose fault is it?

If I operate machinery or any kind of device that I'm clueless about and I screw up it definitely is my fault, yes.

The driver was chosen because there was an existing, easy-to-follow PoC exploit for the vulnerability, though. There are bound to be other drivers that are vulnerable and the VBA would change only where the vulnerability in the driver differed. Being able to do this from a document file is still plenty concerning.